Daily briefing · July 18, 2026
VMware Avi Load Balancer and Open-Source Stacks Drive a Quiet but Patch-Heavy Friday
Automated Vexday summary · sources: NVD, CISA KEV, EPSS
Verdict of the day — calm
July 18, 2026 was a calm day by exploitation metrics — no active weaponization, no KEV additions, and no VulnCheck early warnings — but the disclosure load was real: 91 new CVEs published, five of them critical, with VMware Avi Load Balancer alone accounting for a cluster of high-severity issues ranging from authentication bypass to remote code execution. Developers relying on @fastify/http-proxy and SurrealDB also received urgent patching notices. The day's tone is one of disciplined patch management rather than emergency response.
Today’s brief
- VMware Avi Load Balancer received four CVEs in one day, including a CVSS 9.8 auth bypass and two RCE flaws — patch windows are defined and patches are available.
- @fastify/http-proxy earned a rare CVSS 10.0 for a prefix-rewrite bypass exploitable via URL-encoded paths.
- SurrealDB users face two separate critical issues: a backup-import privilege escalation and a format string memory-read/RCE when scripting is enabled.
- No active exploitation or weaponized exploits observed today — monitoring posture is appropriate, but patching should not be deferred.
Critical highlights
1
A CVSS 10.0 flaw in @fastify/http-proxy (≤11.5.0) allows attackers to bypass configured path prefix restrictions by URL-encoding one or more characters of the prefix, since the rewrite logic compares a decoded route against an encoded request.url. Any service using this library as a reverse proxy with prefix isolation should treat this as a critical architectural exposure until patched.
2
VMware Avi Load Balancer (versions 22.1.1 through 31.2.2) contains an authentication bypass that allows a network-accessible attacker to reach the Avi Control plane without valid credentials — a pre-auth entry point to a load balancer control surface is among the most dangerous positions an attacker can reach. Fixed versions are available across all affected branches.
3
SurrealDB before 2.0.5, 2.1.5, and 2.2.2 improperly escapes table and field names in CLI exports, enabling an authenticated OWNER or EDITOR to embed malicious SurrealQL that executes when a higher-privileged user imports the backup. This is a supply-chain-style privilege escalation path through backup files that security teams should factor into their data pipeline trust models.
4
The urwid web display backend generates session identifiers using Python's Mersenne Twister PRNG, which is not cryptographically secure; an attacker who observes enough session tokens can reconstruct PRNG state and predict or forge future session IDs. Applications exposing urwid's web backend over a network should prioritize patching or disable the web backend until a fix is applied.
5
SurrealDB before 1.1.1 with scripting enabled is vulnerable to a format string attack via the rquickjs exception handler, potentially allowing arbitrary memory reads or code execution at the SurrealDB process privilege level. Any deployment with scripting features enabled should treat this as a critical-priority patch, even given the older version range.
6
An authenticated user on VMware Avi Load Balancer (multiple versions through 32.1.1) can perform directory traversal due to insufficient file path validation, potentially reading or writing files outside intended directories. Combined with the auth bypass in CVE-2026-47865, this becomes a chained exploitation risk.
7
QueryWeaver's signup endpoint unconditionally issues a session token via a Cypher MERGE before checking whether the submitted email already belongs to an existing account, allowing an unauthenticated attacker who knows a victim's email to obtain a valid session token for that account. This is a logic-level authentication bypass with no exploitation complexity required.
8
An authenticated VMware Avi Load Balancer user with network access can inject and execute arbitrary code, making this a post-authentication RCE that elevates the risk of any initial foothold on the platform. Patched in 32.1.2, 31.2.2-2p3, and 30.2.7.
9
A second RCE in VMware Avi Load Balancer affects the Control plane and is exploitable by a network-accessible user, potentially without requiring high privileges depending on interaction with the auth bypass CVE. Organizations running Avi in internet-exposed or multi-tenant environments should prioritize this cluster of four CVEs immediately.
10
A stored XSS in parisneo/lollms via the POST /api/prompts/share endpoint writes unsanitized prompt content into a direct message rendered with v-html, meaning a malicious shared prompt can execute arbitrary JavaScript in the victim's browser session. In AI assistant platforms handling sensitive user data, stored XSS can escalate to session hijacking or data exfiltration.
Ransomware today
LockBit5 dominated recent ransomware activity with an aggressive campaign targeting Brazilian organizations across multiple sectors, claiming victims including kenta.com.br (Technology), limpebras.com.br and grupoferrosider.com.br (Manufacturing), gruposelpe.com.br and guarnera.com.br (Business Services), uniplaclages.edu.br and fiepe.org.br (Education), and erstransportes.com.br (Transportation/Logistics). The group nova also emerged with a claim against FMZ Tecnologia em Sistemas. Over the past 30 days, LockBit5 leads all groups with 49 recorded victims, followed by LockBit3 (39), RansomHub (35), TheGentlemen (20), 8Base (20), and ArcusMedia (19).
kenta.com.br BRlockbit5 · Technology
limpebras.com.br BRlockbit5 · Manufacturing
guarnera.com.br BRlockbit5 · Business Services
FMZ Tecnologia em Sistemas BRnova · Technology
gruposelpe.com.br BRlockbit5 · Business Services
technicare.com.br BRlockbit5 · Technology
uniplaclages.edu.br BRlockbit5 · Education
grupoferrosider.com.br BRlockbit5 · Manufacturing
fastindustria.com.br BRlockbit5 · Manufacturing
fiepe.org.br BRlockbit5 · Education
erstransportes.com.br BRlockbit5 · Transportation/Logistics
5deagosto.com.br BRlockbit5 · Consumer Services
lockbit5 49lockbit3 39ransomhub 35thegentlemen 208base 20arcusmedia 19
Active groups & APTs
Several threat actor groups were flagged as active or updated in intelligence feeds, including Iranian-linked groups BlackShadow and CopyKittens, alongside apt73, CoinbaseCartel, DragonForce, and AgainstTheWest. No confirmed new victims were attributed to these actors in the current reporting window, but their active status warrants monitoring — particularly for organizations in sectors historically targeted by Iranian state-affiliated groups.
Brazil focus
Brazil is facing a concentrated ransomware surge, with LockBit5 accounting for the vast majority of recent victim disclosures across Technology, Manufacturing, Business Services, Education, and Transportation sectors. Notable Brazilian targets include uniplaclages.edu.br (Education), grupoferrosider.com.br (Manufacturing), and technicare.com.br (Technology), with the group nova also claiming FMZ Tecnologia em Sistemas. The breadth of sectors hit signals an opportunistic, high-volume campaign rather than targeted intrusions.
grupoferrosider.com.brlockbit5 · Manufacturing
uniplaclages.edu.brlockbit5 · Education
gruposelpe.com.brlockbit5 · Business Services
kenta.com.brlockbit5 · Technology
limpebras.com.brlockbit5 · Manufacturing
guarnera.com.brlockbit5 · Business Services
FMZ Tecnologia em Sistemasnova · Technology
technicare.com.brlockbit5 · Technology
Today’s recommendation: Organizations running VMware Avi Load Balancer should apply the published patches immediately, treating the auth bypass (CVE-2026-47865) and RCE flaws as a chained risk cluster; SurrealDB and @fastify/http-proxy operators should update to patched versions without waiting for exploitation evidence given the severity scores.
Even on a calm day with no active exploitation confirmed, the breadth of today's disclosures is a reminder that understanding which of these products and versions exist in your own environment is the first step to knowing whether you are actually at risk.Before an attacker finds it, find it first: run a free initial exposure assessment and see whether your infrastructure is vulnerable to flaws like these.Meet the Autonomous AI Pentest Agent →Previous briefings
August 6, 2026 — 10 Active Exploits, 1 Weaponized in a Day: Critical Alert Across WordPress, SharePoint, SonicWall, and MoreAugust 5, 2026 — Cisco SD-WAN, MarkLogic, and PraisonAI Lead a Batch of Critical CVEs on a Calm Exploitation DayAugust 4, 2026 — Quiet Day Masks 10 Critical CVEs: RCE, Auth Bypass, and Stack Overflows in FocusAugust 3, 2026 — Adobe Campaign Classic and WAPT Server Hit by Multiple CVSS 10.0 VulnerabilitiesAugust 2, 2026 — Bouncy Castle Mass Patch Day: Six Critical CVEs Drop Alongside SQL Injection and Auth Bypass FlawsAugust 1, 2026 — WordPress Auth Bypasses and FreeRDP Heap Flaws Top a Calm Vulnerability DayJuly 31, 2026 — Calm Day Hides Critical Flaws: Hard-coded Keys, File Uploads, and Code Injection Dominate July 31July 30, 2026 — 32 Critical CVEs, No Active Exploitation: Azure Cosmos DB and IBM Products Lead a Heavy Patch DayJuly 29, 2026 — Cisco FMC Under Active Exploit, Joomla Gridbox Cluster Hits Critical Mass with Four CVEsJuly 28, 2026 — Quiet Day Hides Critical Vulnerabilities: IBM WebSphere, Apache Axis2, and Joomla Top the ListJuly 27, 2026 — CVE-2026-16812: VeloCloud Orchestrator Under Active Exploitation as Critical Flaws Pile Up Across Enterprise and WordPress StacksJuly 26, 2026 — Quiet Vulnerability Day as Brazil Faces Ransomware Wave From Multiple GroupsJuly 25, 2026 — CVSS 10.0 in SiYuan and Auth Bypass in OpenRemote Lead a Calm Day for New ExploitsJuly 24, 2026 — Three CVSS 10.0 Microsoft Cloud Flaws Lead a Calm but Notable Patch Dayview full archive →